Sanbox Review 2026

Sanbox by Sanlabs runs AI agents in isolated, resumable MicroVM sandboxes with persistent filesystems, live run events, network ACLs, and self-hosting options.

Sanbox, built by Germany-based Sanlabs, gives AI agents a real security boundary instead of relying on prompts to keep them in line. Every run gets its own MicroVM with a dedicated guest kernel, explicit CPU, memory, and timeout limits, a persistent filesystem, and a default-deny network policy with explicit destination grants and private-IP blocking. From the CLI (installed via npm as @sanlabs/sanbox-cli), a terminal, a CI job, or a coding agent like Codex or Claude Code, you can fan out parallel runs — for example, four agents reviewing an acquisition's financials, contracts, market, and security posture at once — and watch live run events stream in: agent turns, tool calls, file changes, model usage, and errors. Everything about a run lives under one run ID: the input bundle, runner settings, event stream, filesystem snapshot, and outputs. Snapshots capture artifacts, agent state, and conversation history, so you can stop a sandbox, inspect the record, and resume it later exactly where it left off. Runners are model-selectable — the OpenCode runner supports multiple models today with a stable adapter contract for more — and reusable run templates pin an approved image, model, limits, and egress policy. Scoped, short-lived secrets keep long-lived credentials out of the sandbox. Deployment options include EU-managed dedicated infrastructure in Germany, your own VPC, or on-prem hardware. Pricing is not published; access is via a signup request. MCP support is not mentioned on the site.